🎯 EtherHiding

The items that name it 13

• Earliest Known PolinRider Malware Found in 2025 npm Packages
  writeup2026-10-30

  Stores executable payload stages in blockchain transaction calldata (BNB Smart Chain block 46456153, 2025-02-07 17:37:33 UTC; Ethereum block 21795760, 2025-02-07 16:15:11 UTC)

• Tensorlake npm package compromised by Shai-Hulud in latest software supply chain attack | Blog | Endor Labs
  advisory2026-10-08It is written here as EtherHiding (on-chain C2 dead-drop).

  Malware reads an ETH resolver wallet (0xb614155Fd88114d40549b259457Bcf921Df091B9) as a durable on-chain dead-drop to fetch the current, rotated C2 domain

• Evolution of Web3 in Cloud Supply Chain Attacks
  article2026-10-07It is written here as EtherHiding (Phase 1).

  Malware loaders issue read-only eth_call JSON-RPC requests to a hardcoded smart contract address to retrieve C2 domains stored in contract state variables; used by ChainDrop. The contract address is exposed in the request and can be blocked.

• The Fine Art of Frustrating the Adversary
  article2026-10-01

  Storing a malware's C2 domain in the metadata of a blockchain smart contract (BNB Smart Chain) to resist takedown, used by ZigCryptoStealer.

• DPRK and Iran are Leading a 5.2x Surge YoY in Blockchain-Assisted Cyberattacks
  article2026-09-17

  Contract-based BDD storage: malware retrieves C2 configurations/payload references/infrastructure pointers from smart contract-readable data on EVM chains; originated mid-2023 by ClearFake on BSC

• ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager
  writeup2026-09-08

  Storing and retrieving encoded malicious JavaScript/C2 configuration from BNB Smart Chain smart contracts (testnet contract and OS-specific contracts) used both by the delivery framework and later by ZigCryptoStealer for C2 resolution via setData()

• The OpenSourceMalware Show #17
  talk2026-08-14

  Technique to obfuscate where a malware's next stage is fetched from, referenced as related to and sometimes combined with NullReceiver

• The OpenSourceMalware Show #16
  talk2026-08-08

  Embedding a secret (C2 URL or malicious script) in the data/memo field of a transaction sent to Ethereum's burn address; destination address itself is meaningless

• NullReceiver's Blank Crypto Transfers Solves the Challenges of EtherHiding
  writeup2026-08-02

  Blockchain-based C2 technique attributed by Google Threat Intelligence (GTIG) to a DPRK-linked actor in October 2025; sends a transaction to Ethereum's well-known burn address (0x000...dEaD) and embeds a C2 URL or malicious script inside the transaction's data field (calldata); destination address i

• The OpenSourceMalware Show #15
  talk2026-07-31

  Technique used by DPRK actors for months to serve/rotate payloads from the typo-crypto package, meaning IOCs extracted now differ from those at time of original compromise.

• The OpenSourceMalware Show #14
  talk2026-07-23It is written here as Ether hiding (blockchain memo abuse).

  DPRK TTP using blockchains such as Aptos, Tron, and Binance Smart Chain, which have mutable 'memo' fields, to hide payloads/C2 data by paying to change the memo, evading detection since it resembles legitimate blockchain traffic.

• Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT
  writeup2026-07-22

  Storing/rotating command-and-control information via transactions on the Ethereum blockchain (including BSC), providing a takedown-resilient means to shift C2 services; used both in the VMProtected loader and in the .NET RAT payload.

• Potemkin Loader & RMMProject The Anatomy of a ClickFix Attack
  writeup2026-06-16

  EtherRAT reads its live C2 address from an Ethereum smart contract via eth_call requests across seven public RPC providers, decoding the ABI-encoded returned string, avoiding hardcoded C2 domains.